s3: Remove unused "retry" from cli_full_connection
[nivanova/samba-autobuild/.git] / source3 / utils / net_ads.c
1 /*
2    Samba Unix/Linux SMB client library
3    net ads commands
4    Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
5    Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
6    Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
7    Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "librpc/gen_ndr/ndr_krb5pac.h"
26 #include "../librpc/gen_ndr/cli_spoolss.h"
27 #include "nsswitch/libwbclient/wbclient.h"
28 #include "ads.h"
29 #include "libads/cldap.h"
30 #include "libads/dns.h"
31 #include "../libds/common/flags.h"
32 #include "librpc/gen_ndr/libnet_join.h"
33 #include "libnet/libnet_join.h"
34 #include "smb_krb5.h"
35 #include "secrets.h"
36 #include "krb5_env.h"
37 #include "../libcli/security/security.h"
38
39 #ifdef HAVE_ADS
40
41 /* when we do not have sufficient input parameters to contact a remote domain
42  * we always fall back to our own realm - Guenther*/
43
44 static const char *assume_own_realm(struct net_context *c)
45 {
46         if (!c->opt_host && strequal(lp_workgroup(), c->opt_target_workgroup)) {
47                 return lp_realm();
48         }
49
50         return NULL;
51 }
52
53 /*
54   do a cldap netlogon query
55 */
56 static int net_ads_cldap_netlogon(struct net_context *c, ADS_STRUCT *ads)
57 {
58         char addr[INET6_ADDRSTRLEN];
59         struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
60
61         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
62         if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
63                 d_fprintf(stderr, _("CLDAP query failed!\n"));
64                 return -1;
65         }
66
67         d_printf(_("Information for Domain Controller: %s\n\n"),
68                 addr);
69
70         d_printf(_("Response Type: "));
71         switch (reply.command) {
72         case LOGON_SAM_LOGON_USER_UNKNOWN_EX:
73                 d_printf("LOGON_SAM_LOGON_USER_UNKNOWN_EX\n");
74                 break;
75         case LOGON_SAM_LOGON_RESPONSE_EX:
76                 d_printf("LOGON_SAM_LOGON_RESPONSE_EX\n");
77                 break;
78         default:
79                 d_printf("0x%x\n", reply.command);
80                 break;
81         }
82
83         d_printf(_("GUID: %s\n"), GUID_string(talloc_tos(),&reply.domain_uuid));
84
85         d_printf(_("Flags:\n"
86                    "\tIs a PDC:                                   %s\n"
87                    "\tIs a GC of the forest:                      %s\n"
88                    "\tIs an LDAP server:                          %s\n"
89                    "\tSupports DS:                                %s\n"
90                    "\tIs running a KDC:                           %s\n"
91                    "\tIs running time services:                   %s\n"
92                    "\tIs the closest DC:                          %s\n"
93                    "\tIs writable:                                %s\n"
94                    "\tHas a hardware clock:                       %s\n"
95                    "\tIs a non-domain NC serviced by LDAP server: %s\n"
96                    "\tIs NT6 DC that has some secrets:            %s\n"
97                    "\tIs NT6 DC that has all secrets:             %s\n"),
98                    (reply.server_type & NBT_SERVER_PDC) ? _("yes") : _("no"),
99                    (reply.server_type & NBT_SERVER_GC) ? _("yes") : _("no"),
100                    (reply.server_type & NBT_SERVER_LDAP) ? _("yes") : _("no"),
101                    (reply.server_type & NBT_SERVER_DS) ? _("yes") : _("no"),
102                    (reply.server_type & NBT_SERVER_KDC) ? _("yes") : _("no"),
103                    (reply.server_type & NBT_SERVER_TIMESERV) ? _("yes") : _("no"),
104                    (reply.server_type & NBT_SERVER_CLOSEST) ? _("yes") : _("no"),
105                    (reply.server_type & NBT_SERVER_WRITABLE) ? _("yes") : _("no"),
106                    (reply.server_type & NBT_SERVER_GOOD_TIMESERV) ? _("yes") : _("no"),
107                    (reply.server_type & NBT_SERVER_NDNC) ? _("yes") : _("no"),
108                    (reply.server_type & NBT_SERVER_SELECT_SECRET_DOMAIN_6) ? _("yes") : _("no"),
109                    (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? _("yes") : _("no"));
110
111
112         printf(_("Forest:\t\t\t%s\n"), reply.forest);
113         printf(_("Domain:\t\t\t%s\n"), reply.dns_domain);
114         printf(_("Domain Controller:\t%s\n"), reply.pdc_dns_name);
115
116         printf(_("Pre-Win2k Domain:\t%s\n"), reply.domain_name);
117         printf(_("Pre-Win2k Hostname:\t%s\n"), reply.pdc_name);
118
119         if (*reply.user_name) printf(_("User name:\t%s\n"), reply.user_name);
120
121         printf(_("Server Site Name :\t\t%s\n"), reply.server_site);
122         printf(_("Client Site Name :\t\t%s\n"), reply.client_site);
123
124         d_printf(_("NT Version: %d\n"), reply.nt_version);
125         d_printf(_("LMNT Token: %.2x\n"), reply.lmnt_token);
126         d_printf(_("LM20 Token: %.2x\n"), reply.lm20_token);
127
128         return 0;
129 }
130
131 /*
132   this implements the CLDAP based netlogon lookup requests
133   for finding the domain controller of a ADS domain
134 */
135 static int net_ads_lookup(struct net_context *c, int argc, const char **argv)
136 {
137         ADS_STRUCT *ads;
138         int ret;
139
140         if (c->display_usage) {
141                 d_printf("%s\n"
142                          "net ads lookup\n"
143                          "    %s",
144                          _("Usage:"),
145                          _("Find the ADS DC using CLDAP lookup.\n"));
146                 return 0;
147         }
148
149         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
150                 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
151                 ads_destroy(&ads);
152                 return -1;
153         }
154
155         if (!ads->config.realm) {
156                 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
157                 ads->ldap.port = 389;
158         }
159
160         ret = net_ads_cldap_netlogon(c, ads);
161         ads_destroy(&ads);
162         return ret;
163 }
164
165
166
167 static int net_ads_info(struct net_context *c, int argc, const char **argv)
168 {
169         ADS_STRUCT *ads;
170         char addr[INET6_ADDRSTRLEN];
171
172         if (c->display_usage) {
173                 d_printf("%s\n"
174                          "net ads info\n"
175                          "    %s",
176                          _("Usage:"),
177                          _("Display information about an Active Directory "
178                            "server.\n"));
179                 return 0;
180         }
181
182         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
183                 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
184                 return -1;
185         }
186
187         if (!ads || !ads->config.realm) {
188                 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
189                 ads_destroy(&ads);
190                 return -1;
191         }
192
193         /* Try to set the server's current time since we didn't do a full
194            TCP LDAP session initially */
195
196         if ( !ADS_ERR_OK(ads_current_time( ads )) ) {
197                 d_fprintf( stderr, _("Failed to get server's current time!\n"));
198         }
199
200         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
201
202         d_printf(_("LDAP server: %s\n"), addr);
203         d_printf(_("LDAP server name: %s\n"), ads->config.ldap_server_name);
204         d_printf(_("Realm: %s\n"), ads->config.realm);
205         d_printf(_("Bind Path: %s\n"), ads->config.bind_path);
206         d_printf(_("LDAP port: %d\n"), ads->ldap.port);
207         d_printf(_("Server time: %s\n"),
208                          http_timestring(talloc_tos(), ads->config.current_time));
209
210         d_printf(_("KDC server: %s\n"), ads->auth.kdc_server );
211         d_printf(_("Server time offset: %d\n"), ads->auth.time_offset );
212
213         ads_destroy(&ads);
214         return 0;
215 }
216
217 static void use_in_memory_ccache(void) {
218         /* Use in-memory credentials cache so we do not interfere with
219          * existing credentials */
220         setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
221 }
222
223 static ADS_STATUS ads_startup_int(struct net_context *c, bool only_own_domain,
224                                   uint32 auth_flags, ADS_STRUCT **ads_ret)
225 {
226         ADS_STRUCT *ads = NULL;
227         ADS_STATUS status;
228         bool need_password = false;
229         bool second_time = false;
230         char *cp;
231         const char *realm = NULL;
232         bool tried_closest_dc = false;
233
234         /* lp_realm() should be handled by a command line param,
235            However, the join requires that realm be set in smb.conf
236            and compares our realm with the remote server's so this is
237            ok until someone needs more flexibility */
238
239         *ads_ret = NULL;
240
241 retry_connect:
242         if (only_own_domain) {
243                 realm = lp_realm();
244         } else {
245                 realm = assume_own_realm(c);
246         }
247
248         ads = ads_init(realm, c->opt_target_workgroup, c->opt_host);
249
250         if (!c->opt_user_name) {
251                 c->opt_user_name = "administrator";
252         }
253
254         if (c->opt_user_specified) {
255                 need_password = true;
256         }
257
258 retry:
259         if (!c->opt_password && need_password && !c->opt_machine_pass) {
260                 c->opt_password = net_prompt_pass(c, c->opt_user_name);
261                 if (!c->opt_password) {
262                         ads_destroy(&ads);
263                         return ADS_ERROR(LDAP_NO_MEMORY);
264                 }
265         }
266
267         if (c->opt_password) {
268                 use_in_memory_ccache();
269                 SAFE_FREE(ads->auth.password);
270                 ads->auth.password = smb_xstrdup(c->opt_password);
271         }
272
273         ads->auth.flags |= auth_flags;
274         SAFE_FREE(ads->auth.user_name);
275         ads->auth.user_name = smb_xstrdup(c->opt_user_name);
276
277        /*
278         * If the username is of the form "name@realm",
279         * extract the realm and convert to upper case.
280         * This is only used to establish the connection.
281         */
282        if ((cp = strchr_m(ads->auth.user_name, '@'))!=0) {
283                 *cp++ = '\0';
284                 SAFE_FREE(ads->auth.realm);
285                 ads->auth.realm = smb_xstrdup(cp);
286                 strupper_m(ads->auth.realm);
287        }
288
289         status = ads_connect(ads);
290
291         if (!ADS_ERR_OK(status)) {
292
293                 if (NT_STATUS_EQUAL(ads_ntstatus(status),
294                                     NT_STATUS_NO_LOGON_SERVERS)) {
295                         DEBUG(0,("ads_connect: %s\n", ads_errstr(status)));
296                         ads_destroy(&ads);
297                         return status;
298                 }
299
300                 if (!need_password && !second_time && !(auth_flags & ADS_AUTH_NO_BIND)) {
301                         need_password = true;
302                         second_time = true;
303                         goto retry;
304                 } else {
305                         ads_destroy(&ads);
306                         return status;
307                 }
308         }
309
310         /* when contacting our own domain, make sure we use the closest DC.
311          * This is done by reconnecting to ADS because only the first call to
312          * ads_connect will give us our own sitename */
313
314         if ((only_own_domain || !c->opt_host) && !tried_closest_dc) {
315
316                 tried_closest_dc = true; /* avoid loop */
317
318                 if (!ads_closest_dc(ads)) {
319
320                         namecache_delete(ads->server.realm, 0x1C);
321                         namecache_delete(ads->server.workgroup, 0x1C);
322
323                         ads_destroy(&ads);
324                         ads = NULL;
325
326                         goto retry_connect;
327                 }
328         }
329
330         *ads_ret = ads;
331         return status;
332 }
333
334 ADS_STATUS ads_startup(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
335 {
336         return ads_startup_int(c, only_own_domain, 0, ads);
337 }
338
339 ADS_STATUS ads_startup_nobind(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
340 {
341         return ads_startup_int(c, only_own_domain, ADS_AUTH_NO_BIND, ads);
342 }
343
344 /*
345   Check to see if connection can be made via ads.
346   ads_startup() stores the password in opt_password if it needs to so
347   that rpc or rap can use it without re-prompting.
348 */
349 static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
350 {
351         ADS_STRUCT *ads;
352         ADS_STATUS status;
353
354         if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
355                 return -1;
356         }
357
358         ads->auth.flags |= ADS_AUTH_NO_BIND;
359
360         status = ads_connect(ads);
361         if ( !ADS_ERR_OK(status) ) {
362                 return -1;
363         }
364
365         ads_destroy(&ads);
366         return 0;
367 }
368
369 int net_ads_check_our_domain(struct net_context *c)
370 {
371         return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
372 }
373
374 int net_ads_check(struct net_context *c)
375 {
376         return net_ads_check_int(NULL, c->opt_workgroup, c->opt_host);
377 }
378
379 /*
380    determine the netbios workgroup name for a domain
381  */
382 static int net_ads_workgroup(struct net_context *c, int argc, const char **argv)
383 {
384         ADS_STRUCT *ads;
385         char addr[INET6_ADDRSTRLEN];
386         struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
387
388         if (c->display_usage) {
389                 d_printf  ("%s\n"
390                            "net ads workgroup\n"
391                            "    %s\n",
392                          _("Usage:"),
393                          _("Print the workgroup name"));
394                 return 0;
395         }
396
397         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
398                 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
399                 return -1;
400         }
401
402         if (!ads->config.realm) {
403                 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
404                 ads->ldap.port = 389;
405         }
406
407         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
408         if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
409                 d_fprintf(stderr, _("CLDAP query failed!\n"));
410                 ads_destroy(&ads);
411                 return -1;
412         }
413
414         d_printf(_("Workgroup: %s\n"), reply.domain_name);
415
416         ads_destroy(&ads);
417
418         return 0;
419 }
420
421
422
423 static bool usergrp_display(ADS_STRUCT *ads, char *field, void **values, void *data_area)
424 {
425         char **disp_fields = (char **) data_area;
426
427         if (!field) { /* must be end of record */
428                 if (disp_fields[0]) {
429                         if (!strchr_m(disp_fields[0], '$')) {
430                                 if (disp_fields[1])
431                                         d_printf("%-21.21s %s\n",
432                                                disp_fields[0], disp_fields[1]);
433                                 else
434                                         d_printf("%s\n", disp_fields[0]);
435                         }
436                 }
437                 SAFE_FREE(disp_fields[0]);
438                 SAFE_FREE(disp_fields[1]);
439                 return true;
440         }
441         if (!values) /* must be new field, indicate string field */
442                 return true;
443         if (StrCaseCmp(field, "sAMAccountName") == 0) {
444                 disp_fields[0] = SMB_STRDUP((char *) values[0]);
445         }
446         if (StrCaseCmp(field, "description") == 0)
447                 disp_fields[1] = SMB_STRDUP((char *) values[0]);
448         return true;
449 }
450
451 static int net_ads_user_usage(struct net_context *c, int argc, const char **argv)
452 {
453         return net_user_usage(c, argc, argv);
454 }
455
456 static int ads_user_add(struct net_context *c, int argc, const char **argv)
457 {
458         ADS_STRUCT *ads;
459         ADS_STATUS status;
460         char *upn, *userdn;
461         LDAPMessage *res=NULL;
462         int rc = -1;
463         char *ou_str = NULL;
464
465         if (argc < 1 || c->display_usage)
466                 return net_ads_user_usage(c, argc, argv);
467
468         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
469                 return -1;
470         }
471
472         status = ads_find_user_acct(ads, &res, argv[0]);
473
474         if (!ADS_ERR_OK(status)) {
475                 d_fprintf(stderr, _("ads_user_add: %s\n"), ads_errstr(status));
476                 goto done;
477         }
478
479         if (ads_count_replies(ads, res)) {
480                 d_fprintf(stderr, _("ads_user_add: User %s already exists\n"),
481                           argv[0]);
482                 goto done;
483         }
484
485         if (c->opt_container) {
486                 ou_str = SMB_STRDUP(c->opt_container);
487         } else {
488                 ou_str = ads_default_ou_string(ads, DS_GUID_USERS_CONTAINER);
489         }
490
491         status = ads_add_user_acct(ads, argv[0], ou_str, c->opt_comment);
492
493         if (!ADS_ERR_OK(status)) {
494                 d_fprintf(stderr, _("Could not add user %s: %s\n"), argv[0],
495                          ads_errstr(status));
496                 goto done;
497         }
498
499         /* if no password is to be set, we're done */
500         if (argc == 1) {
501                 d_printf(_("User %s added\n"), argv[0]);
502                 rc = 0;
503                 goto done;
504         }
505
506         /* try setting the password */
507         if (asprintf(&upn, "%s@%s", argv[0], ads->config.realm) == -1) {
508                 goto done;
509         }
510         status = ads_krb5_set_password(ads->auth.kdc_server, upn, argv[1],
511                                        ads->auth.time_offset);
512         SAFE_FREE(upn);
513         if (ADS_ERR_OK(status)) {
514                 d_printf(_("User %s added\n"), argv[0]);
515                 rc = 0;
516                 goto done;
517         }
518
519         /* password didn't set, delete account */
520         d_fprintf(stderr, _("Could not add user %s. "
521                             "Error setting password %s\n"),
522                  argv[0], ads_errstr(status));
523         ads_msgfree(ads, res);
524         status=ads_find_user_acct(ads, &res, argv[0]);
525         if (ADS_ERR_OK(status)) {
526                 userdn = ads_get_dn(ads, talloc_tos(), res);
527                 ads_del_dn(ads, userdn);
528                 TALLOC_FREE(userdn);
529         }
530
531  done:
532         if (res)
533                 ads_msgfree(ads, res);
534         ads_destroy(&ads);
535         SAFE_FREE(ou_str);
536         return rc;
537 }
538
539 static int ads_user_info(struct net_context *c, int argc, const char **argv)
540 {
541         ADS_STRUCT *ads = NULL;
542         ADS_STATUS rc;
543         LDAPMessage *res = NULL;
544         TALLOC_CTX *frame;
545         int ret = 0;
546         wbcErr wbc_status;
547         const char *attrs[] = {"memberOf", "primaryGroupID", NULL};
548         char *searchstring=NULL;
549         char **grouplist;
550         char *primary_group;
551         char *escaped_user;
552         struct dom_sid primary_group_sid;
553         uint32_t group_rid;
554         enum wbcSidType type;
555
556         if (argc < 1 || c->display_usage) {
557                 return net_ads_user_usage(c, argc, argv);
558         }
559
560         frame = talloc_new(talloc_tos());
561         if (frame == NULL) {
562                 return -1;
563         }
564
565         escaped_user = escape_ldap_string(frame, argv[0]);
566         if (!escaped_user) {
567                 d_fprintf(stderr,
568                           _("ads_user_info: failed to escape user %s\n"),
569                           argv[0]);
570                 return -1;
571         }
572
573         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
574                 ret = -1;
575                 goto error;
576         }
577
578         if (asprintf(&searchstring, "(sAMAccountName=%s)", escaped_user) == -1) {
579                 ret =-1;
580                 goto error;
581         }
582         rc = ads_search(ads, &res, searchstring, attrs);
583         SAFE_FREE(searchstring);
584
585         if (!ADS_ERR_OK(rc)) {
586                 d_fprintf(stderr, _("ads_search: %s\n"), ads_errstr(rc));
587                 ret = -1;
588                 goto error;
589         }
590
591         if (!ads_pull_uint32(ads, res, "primaryGroupID", &group_rid)) {
592                 d_fprintf(stderr, _("ads_pull_uint32 failed\n"));
593                 ret = -1;
594                 goto error;
595         }
596
597         rc = ads_domain_sid(ads, &primary_group_sid);
598         if (!ADS_ERR_OK(rc)) {
599                 d_fprintf(stderr, _("ads_domain_sid: %s\n"), ads_errstr(rc));
600                 ret = -1;
601                 goto error;
602         }
603
604         sid_append_rid(&primary_group_sid, group_rid);
605
606         wbc_status = wbcLookupSid((struct wbcDomainSid *)&primary_group_sid,
607                                   NULL, /* don't look up domain */
608                                   &primary_group,
609                                   &type);
610         if (!WBC_ERROR_IS_OK(wbc_status)) {
611                 d_fprintf(stderr, "wbcLookupSid: %s\n",
612                           wbcErrorString(wbc_status));
613                 ret = -1;
614                 goto error;
615         }
616
617         d_printf("%s\n", primary_group);
618
619         wbcFreeMemory(primary_group);
620
621         grouplist = ldap_get_values((LDAP *)ads->ldap.ld,
622                                     (LDAPMessage *)res, "memberOf");
623
624         if (grouplist) {
625                 int i;
626                 char **groupname;
627                 for (i=0;grouplist[i];i++) {
628                         groupname = ldap_explode_dn(grouplist[i], 1);
629                         d_printf("%s\n", groupname[0]);
630                         ldap_value_free(groupname);
631                 }
632                 ldap_value_free(grouplist);
633         }
634
635 error:
636         if (res) ads_msgfree(ads, res);
637         if (ads) ads_destroy(&ads);
638         TALLOC_FREE(frame);
639         return ret;
640 }
641
642 static int ads_user_delete(struct net_context *c, int argc, const char **argv)
643 {
644         ADS_STRUCT *ads;
645         ADS_STATUS rc;
646         LDAPMessage *res = NULL;
647         char *userdn;
648
649         if (argc < 1) {
650                 return net_ads_user_usage(c, argc, argv);
651         }
652
653         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
654                 return -1;
655         }
656
657         rc = ads_find_user_acct(ads, &res, argv[0]);
658         if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
659                 d_printf(_("User %s does not exist.\n"), argv[0]);
660                 ads_msgfree(ads, res);
661                 ads_destroy(&ads);
662                 return -1;
663         }
664         userdn = ads_get_dn(ads, talloc_tos(), res);
665         ads_msgfree(ads, res);
666         rc = ads_del_dn(ads, userdn);
667         TALLOC_FREE(userdn);
668         if (ADS_ERR_OK(rc)) {
669                 d_printf(_("User %s deleted\n"), argv[0]);
670                 ads_destroy(&ads);
671                 return 0;
672         }
673         d_fprintf(stderr, _("Error deleting user %s: %s\n"), argv[0],
674                  ads_errstr(rc));
675         ads_destroy(&ads);
676         return -1;
677 }
678
679 int net_ads_user(struct net_context *c, int argc, const char **argv)
680 {
681         struct functable func[] = {
682                 {
683                         "add",
684                         ads_user_add,
685                         NET_TRANSPORT_ADS,
686                         N_("Add an AD user"),
687                         N_("net ads user add\n"
688                            "    Add an AD user")
689                 },
690                 {
691                         "info",
692                         ads_user_info,
693                         NET_TRANSPORT_ADS,
694                         N_("Display information about an AD user"),
695                         N_("net ads user info\n"
696                            "    Display information about an AD user")
697                 },
698                 {
699                         "delete",
700                         ads_user_delete,
701                         NET_TRANSPORT_ADS,
702                         N_("Delete an AD user"),
703                         N_("net ads user delete\n"
704                            "    Delete an AD user")
705                 },
706                 {NULL, NULL, 0, NULL, NULL}
707         };
708         ADS_STRUCT *ads;
709         ADS_STATUS rc;
710         const char *shortattrs[] = {"sAMAccountName", NULL};
711         const char *longattrs[] = {"sAMAccountName", "description", NULL};
712         char *disp_fields[2] = {NULL, NULL};
713
714         if (argc == 0) {
715                 if (c->display_usage) {
716                         d_printf(  "%s\n"
717                                    "net ads user\n"
718                                    "    %s\n",
719                                  _("Usage:"),
720                                  _("List AD users"));
721                         net_display_usage_from_functable(func);
722                         return 0;
723                 }
724
725                 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
726                         return -1;
727                 }
728
729                 if (c->opt_long_list_entries)
730                         d_printf(_("\nUser name             Comment"
731                                    "\n-----------------------------\n"));
732
733                 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
734                                           LDAP_SCOPE_SUBTREE,
735                                           "(objectCategory=user)",
736                                           c->opt_long_list_entries ? longattrs :
737                                           shortattrs, usergrp_display,
738                                           disp_fields);
739                 ads_destroy(&ads);
740                 return ADS_ERR_OK(rc) ? 0 : -1;
741         }
742
743         return net_run_function(c, argc, argv, "net ads user", func);
744 }
745
746 static int net_ads_group_usage(struct net_context *c, int argc, const char **argv)
747 {
748         return net_group_usage(c, argc, argv);
749 }
750
751 static int ads_group_add(struct net_context *c, int argc, const char **argv)
752 {
753         ADS_STRUCT *ads;
754         ADS_STATUS status;
755         LDAPMessage *res=NULL;
756         int rc = -1;
757         char *ou_str = NULL;
758
759         if (argc < 1 || c->display_usage) {
760                 return net_ads_group_usage(c, argc, argv);
761         }
762
763         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
764                 return -1;
765         }
766
767         status = ads_find_user_acct(ads, &res, argv[0]);
768
769         if (!ADS_ERR_OK(status)) {
770                 d_fprintf(stderr, _("ads_group_add: %s\n"), ads_errstr(status));
771                 goto done;
772         }
773
774         if (ads_count_replies(ads, res)) {
775                 d_fprintf(stderr, _("ads_group_add: Group %s already exists\n"), argv[0]);
776                 goto done;
777         }
778
779         if (c->opt_container) {
780                 ou_str = SMB_STRDUP(c->opt_container);
781         } else {
782                 ou_str = ads_default_ou_string(ads, DS_GUID_USERS_CONTAINER);
783         }
784
785         status = ads_add_group_acct(ads, argv[0], ou_str, c->opt_comment);
786
787         if (ADS_ERR_OK(status)) {
788                 d_printf(_("Group %s added\n"), argv[0]);
789                 rc = 0;
790         } else {
791                 d_fprintf(stderr, _("Could not add group %s: %s\n"), argv[0],
792                          ads_errstr(status));
793         }
794
795  done:
796         if (res)
797                 ads_msgfree(ads, res);
798         ads_destroy(&ads);
799         SAFE_FREE(ou_str);
800         return rc;
801 }
802
803 static int ads_group_delete(struct net_context *c, int argc, const char **argv)
804 {
805         ADS_STRUCT *ads;
806         ADS_STATUS rc;
807         LDAPMessage *res = NULL;
808         char *groupdn;
809
810         if (argc < 1 || c->display_usage) {
811                 return net_ads_group_usage(c, argc, argv);
812         }
813
814         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
815                 return -1;
816         }
817
818         rc = ads_find_user_acct(ads, &res, argv[0]);
819         if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
820                 d_printf(_("Group %s does not exist.\n"), argv[0]);
821                 ads_msgfree(ads, res);
822                 ads_destroy(&ads);
823                 return -1;
824         }
825         groupdn = ads_get_dn(ads, talloc_tos(), res);
826         ads_msgfree(ads, res);
827         rc = ads_del_dn(ads, groupdn);
828         TALLOC_FREE(groupdn);
829         if (ADS_ERR_OK(rc)) {
830                 d_printf(_("Group %s deleted\n"), argv[0]);
831                 ads_destroy(&ads);
832                 return 0;
833         }
834         d_fprintf(stderr, _("Error deleting group %s: %s\n"), argv[0],
835                  ads_errstr(rc));
836         ads_destroy(&ads);
837         return -1;
838 }
839
840 int net_ads_group(struct net_context *c, int argc, const char **argv)
841 {
842         struct functable func[] = {
843                 {
844                         "add",
845                         ads_group_add,
846                         NET_TRANSPORT_ADS,
847                         N_("Add an AD group"),
848                         N_("net ads group add\n"
849                            "    Add an AD group")
850                 },
851                 {
852                         "delete",
853                         ads_group_delete,
854                         NET_TRANSPORT_ADS,
855                         N_("Delete an AD group"),
856                         N_("net ads group delete\n"
857                            "    Delete an AD group")
858                 },
859                 {NULL, NULL, 0, NULL, NULL}
860         };
861         ADS_STRUCT *ads;
862         ADS_STATUS rc;
863         const char *shortattrs[] = {"sAMAccountName", NULL};
864         const char *longattrs[] = {"sAMAccountName", "description", NULL};
865         char *disp_fields[2] = {NULL, NULL};
866
867         if (argc == 0) {
868                 if (c->display_usage) {
869                         d_printf(  "%s\n"
870                                    "net ads group\n"
871                                    "    %s\n",
872                                  _("Usage:"),
873                                  _("List AD groups"));
874                         net_display_usage_from_functable(func);
875                         return 0;
876                 }
877
878                 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
879                         return -1;
880                 }
881
882                 if (c->opt_long_list_entries)
883                         d_printf(_("\nGroup name            Comment"
884                                    "\n-----------------------------\n"));
885                 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
886                                           LDAP_SCOPE_SUBTREE,
887                                           "(objectCategory=group)",
888                                           c->opt_long_list_entries ? longattrs :
889                                           shortattrs, usergrp_display,
890                                           disp_fields);
891
892                 ads_destroy(&ads);
893                 return ADS_ERR_OK(rc) ? 0 : -1;
894         }
895         return net_run_function(c, argc, argv, "net ads group", func);
896 }
897
898 static int net_ads_status(struct net_context *c, int argc, const char **argv)
899 {
900         ADS_STRUCT *ads;
901         ADS_STATUS rc;
902         LDAPMessage *res;
903
904         if (c->display_usage) {
905                 d_printf(  "%s\n"
906                            "net ads status\n"
907                            "    %s\n",
908                          _("Usage:"),
909                          _("Display machine account details"));
910                 return 0;
911         }
912
913         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
914                 return -1;
915         }
916
917         rc = ads_find_machine_acct(ads, &res, global_myname());
918         if (!ADS_ERR_OK(rc)) {
919                 d_fprintf(stderr, _("ads_find_machine_acct: %s\n"), ads_errstr(rc));
920                 ads_destroy(&ads);
921                 return -1;
922         }
923
924         if (ads_count_replies(ads, res) == 0) {
925                 d_fprintf(stderr, _("No machine account for '%s' found\n"), global_myname());
926                 ads_destroy(&ads);
927                 return -1;
928         }
929
930         ads_dump(ads, res);
931         ads_destroy(&ads);
932         return 0;
933 }
934
935 /*******************************************************************
936  Leave an AD domain.  Windows XP disables the machine account.
937  We'll try the same.  The old code would do an LDAP delete.
938  That only worked using the machine creds because added the machine
939  with full control to the computer object's ACL.
940 *******************************************************************/
941
942 static int net_ads_leave(struct net_context *c, int argc, const char **argv)
943 {
944         TALLOC_CTX *ctx;
945         struct libnet_UnjoinCtx *r = NULL;
946         WERROR werr;
947
948         if (c->display_usage) {
949                 d_printf(  "%s\n"
950                            "net ads leave\n"
951                            "    %s\n",
952                          _("Usage:"),
953                          _("Leave an AD domain"));
954                 return 0;
955         }
956
957         if (!*lp_realm()) {
958                 d_fprintf(stderr, _("No realm set, are we joined ?\n"));
959                 return -1;
960         }
961
962         if (!(ctx = talloc_init("net_ads_leave"))) {
963                 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
964                 return -1;
965         }
966
967         if (!c->opt_kerberos) {
968                 use_in_memory_ccache();
969         }
970
971         if (!c->msg_ctx) {
972                 d_fprintf(stderr, _("Could not initialise message context. "
973                         "Try running as root\n"));
974                 return -1;
975         }
976
977         werr = libnet_init_UnjoinCtx(ctx, &r);
978         if (!W_ERROR_IS_OK(werr)) {
979                 d_fprintf(stderr, _("Could not initialise unjoin context.\n"));
980                 return -1;
981         }
982
983         r->in.debug             = true;
984         r->in.use_kerberos      = c->opt_kerberos;
985         r->in.dc_name           = c->opt_host;
986         r->in.domain_name       = lp_realm();
987         r->in.admin_account     = c->opt_user_name;
988         r->in.admin_password    = net_prompt_pass(c, c->opt_user_name);
989         r->in.modify_config     = lp_config_backend_is_registry();
990
991         /* Try to delete it, but if that fails, disable it.  The
992            WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE really means "disable */
993         r->in.unjoin_flags      = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
994                                   WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
995         r->in.delete_machine_account = true;
996         r->in.msg_ctx           = c->msg_ctx;
997
998         werr = libnet_Unjoin(ctx, r);
999         if (!W_ERROR_IS_OK(werr)) {
1000                 d_printf(_("Failed to leave domain: %s\n"),
1001                          r->out.error_string ? r->out.error_string :
1002                          get_friendly_werror_msg(werr));
1003                 goto done;
1004         }
1005
1006         if (r->out.deleted_machine_account) {
1007                 d_printf(_("Deleted account for '%s' in realm '%s'\n"),
1008                         r->in.machine_name, r->out.dns_domain_name);
1009                 goto done;
1010         }
1011
1012         /* We couldn't delete it - see if the disable succeeded. */
1013         if (r->out.disabled_machine_account) {
1014                 d_printf(_("Disabled account for '%s' in realm '%s'\n"),
1015                         r->in.machine_name, r->out.dns_domain_name);
1016                 werr = WERR_OK;
1017                 goto done;
1018         }
1019
1020         /* Based on what we requseted, we shouldn't get here, but if
1021            we did, it means the secrets were removed, and therefore
1022            we have left the domain */
1023         d_fprintf(stderr, _("Machine '%s' Left domain '%s'\n"),
1024                   r->in.machine_name, r->out.dns_domain_name);
1025
1026  done:
1027         TALLOC_FREE(r);
1028         TALLOC_FREE(ctx);
1029
1030         if (W_ERROR_IS_OK(werr)) {
1031                 return 0;
1032         }
1033
1034         return -1;
1035 }
1036
1037 static NTSTATUS net_ads_join_ok(struct net_context *c)
1038 {
1039         ADS_STRUCT *ads = NULL;
1040         ADS_STATUS status;
1041         fstring dc_name;
1042         struct sockaddr_storage dcip;
1043
1044         if (!secrets_init()) {
1045                 DEBUG(1,("Failed to initialise secrets database\n"));
1046                 return NT_STATUS_ACCESS_DENIED;
1047         }
1048
1049         net_use_krb_machine_account(c);
1050
1051         get_dc_name(lp_workgroup(), lp_realm(), dc_name, &dcip);
1052
1053         status = ads_startup(c, true, &ads);
1054         if (!ADS_ERR_OK(status)) {
1055                 return ads_ntstatus(status);
1056         }
1057
1058         ads_destroy(&ads);
1059         return NT_STATUS_OK;
1060 }
1061
1062 /*
1063   check that an existing join is OK
1064  */
1065 int net_ads_testjoin(struct net_context *c, int argc, const char **argv)
1066 {
1067         NTSTATUS status;
1068         use_in_memory_ccache();
1069
1070         if (c->display_usage) {
1071                 d_printf(  "%s\n"
1072                            "net ads testjoin\n"
1073                            "    %s\n",
1074                          _("Usage:"),
1075                          _("Test if the existing join is ok"));
1076                 return 0;
1077         }
1078
1079         /* Display success or failure */
1080         status = net_ads_join_ok(c);
1081         if (!NT_STATUS_IS_OK(status)) {
1082                 fprintf(stderr, _("Join to domain is not valid: %s\n"),
1083                         get_friendly_nt_error_msg(status));
1084                 return -1;
1085         }
1086
1087         printf(_("Join is OK\n"));
1088         return 0;
1089 }
1090
1091 /*******************************************************************
1092   Simple configu checks before beginning the join
1093  ********************************************************************/
1094
1095 static WERROR check_ads_config( void )
1096 {
1097         if (lp_server_role() != ROLE_DOMAIN_MEMBER ) {
1098                 d_printf(_("Host is not configured as a member server.\n"));
1099                 return WERR_INVALID_DOMAIN_ROLE;
1100         }
1101
1102         if (strlen(global_myname()) > 15) {
1103                 d_printf(_("Our netbios name can be at most 15 chars long, "
1104                            "\"%s\" is %u chars long\n"), global_myname(),
1105                          (unsigned int)strlen(global_myname()));
1106                 return WERR_INVALID_COMPUTERNAME;
1107         }
1108
1109         if ( lp_security() == SEC_ADS && !*lp_realm()) {
1110                 d_fprintf(stderr, _("realm must be set in in %s for ADS "
1111                           "join to succeed.\n"), get_dyn_CONFIGFILE());
1112                 return WERR_INVALID_PARAM;
1113         }
1114
1115         return WERR_OK;
1116 }
1117
1118 /*******************************************************************
1119  Send a DNS update request
1120 *******************************************************************/
1121
1122 #if defined(WITH_DNS_UPDATES)
1123 #include "dns.h"
1124 DNS_ERROR DoDNSUpdate(char *pszServerName,
1125                       const char *pszDomainName, const char *pszHostName,
1126                       const struct sockaddr_storage *sslist,
1127                       size_t num_addrs );
1128
1129 static NTSTATUS net_update_dns_internal(TALLOC_CTX *ctx, ADS_STRUCT *ads,
1130                                         const char *machine_name,
1131                                         const struct sockaddr_storage *addrs,
1132                                         int num_addrs)
1133 {
1134         struct dns_rr_ns *nameservers = NULL;
1135         int ns_count = 0;
1136         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1137         DNS_ERROR dns_err;
1138         fstring dns_server;
1139         const char *dnsdomain = NULL;
1140         char *root_domain = NULL;
1141
1142         if ( (dnsdomain = strchr_m( machine_name, '.')) == NULL ) {
1143                 d_printf(_("No DNS domain configured for %s. "
1144                            "Unable to perform DNS Update.\n"), machine_name);
1145                 status = NT_STATUS_INVALID_PARAMETER;
1146                 goto done;
1147         }
1148         dnsdomain++;
1149
1150         status = ads_dns_lookup_ns( ctx, dnsdomain, &nameservers, &ns_count );
1151         if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1152                 /* Child domains often do not have NS records.  Look
1153                    for the NS record for the forest root domain
1154                    (rootDomainNamingContext in therootDSE) */
1155
1156                 const char *rootname_attrs[] =  { "rootDomainNamingContext", NULL };
1157                 LDAPMessage *msg = NULL;
1158                 char *root_dn;
1159                 ADS_STATUS ads_status;
1160
1161                 if ( !ads->ldap.ld ) {
1162                         ads_status = ads_connect( ads );
1163                         if ( !ADS_ERR_OK(ads_status) ) {
1164                                 DEBUG(0,("net_update_dns_internal: Failed to connect to our DC!\n"));
1165                                 goto done;
1166                         }
1167                 }
1168
1169                 ads_status = ads_do_search(ads, "", LDAP_SCOPE_BASE,
1170                                        "(objectclass=*)", rootname_attrs, &msg);
1171                 if (!ADS_ERR_OK(ads_status)) {
1172                         goto done;
1173                 }
1174
1175                 root_dn = ads_pull_string(ads, ctx, msg,  "rootDomainNamingContext");
1176                 if ( !root_dn ) {
1177                         ads_msgfree( ads, msg );
1178                         goto done;
1179                 }
1180
1181                 root_domain = ads_build_domain( root_dn );
1182
1183                 /* cleanup */
1184                 ads_msgfree( ads, msg );
1185
1186                 /* try again for NS servers */
1187
1188                 status = ads_dns_lookup_ns( ctx, root_domain, &nameservers, &ns_count );
1189
1190                 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1191                         DEBUG(3,("net_ads_join: Failed to find name server for the %s "
1192                          "realm\n", ads->config.realm));
1193                         goto done;
1194                 }
1195
1196                 dnsdomain = root_domain;
1197
1198         }
1199
1200         /* Now perform the dns update - we'll try non-secure and if we fail,
1201            we'll follow it up with a secure update */
1202
1203         fstrcpy( dns_server, nameservers[0].hostname );
1204
1205         dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs);
1206         if (!ERR_DNS_IS_OK(dns_err)) {
1207                 d_printf(_("DNS Update for %s failed: %s\n"),
1208                         machine_name, dns_errstr(dns_err));
1209                 status = NT_STATUS_UNSUCCESSFUL;
1210         }
1211
1212 done:
1213
1214         SAFE_FREE( root_domain );
1215
1216         return status;
1217 }
1218
1219 static NTSTATUS net_update_dns_ext(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads,
1220                                    const char *hostname,
1221                                    struct sockaddr_storage *iplist,
1222                                    int num_addrs)
1223 {
1224         struct sockaddr_storage *iplist_alloc = NULL;
1225         fstring machine_name;
1226         NTSTATUS status;
1227
1228         if (hostname) {
1229                 fstrcpy(machine_name, hostname);
1230         } else {
1231                 name_to_fqdn( machine_name, global_myname() );
1232         }
1233         strlower_m( machine_name );
1234
1235         if (num_addrs == 0 || iplist == NULL) {
1236                 /*
1237                  * Get our ip address
1238                  * (not the 127.0.0.x address but a real ip address)
1239                  */
1240                 num_addrs = get_my_ip_address(&iplist_alloc);
1241                 if ( num_addrs <= 0 ) {
1242                         DEBUG(4, ("net_update_dns_ext: Failed to find my "
1243                                   "non-loopback IP addresses!\n"));
1244                         return NT_STATUS_INVALID_PARAMETER;
1245                 }
1246                 iplist = iplist_alloc;
1247         }
1248
1249         status = net_update_dns_internal(mem_ctx, ads, machine_name,
1250                                          iplist, num_addrs);
1251
1252         SAFE_FREE(iplist_alloc);
1253         return status;
1254 }
1255
1256 static NTSTATUS net_update_dns(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads, const char *hostname)
1257 {
1258         NTSTATUS status;
1259
1260         status = net_update_dns_ext(mem_ctx, ads, hostname, NULL, 0);
1261         return status;
1262 }
1263 #endif
1264
1265
1266 /*******************************************************************
1267  ********************************************************************/
1268
1269 static int net_ads_join_usage(struct net_context *c, int argc, const char **argv)
1270 {
1271         d_printf(_("net ads join [options]\n"
1272                    "Valid options:\n"));
1273         d_printf(_("   createupn[=UPN]    Set the userPrincipalName attribute during the join.\n"
1274                    "                      The deault UPN is in the form host/netbiosname@REALM.\n"));
1275         d_printf(_("   createcomputer=OU  Precreate the computer account in a specific OU.\n"
1276                    "                      The OU string read from top to bottom without RDNs and delimited by a '/'.\n"
1277                    "                      E.g. \"createcomputer=Computers/Servers/Unix\"\n"
1278                    "                      NB: A backslash '\\' is used as escape at multiple levels and may\n"
1279                    "                          need to be doubled or even quadrupled.  It is not used as a separator.\n"));
1280         d_printf(_("   osName=string      Set the operatingSystem attribute during the join.\n"));
1281         d_printf(_("   osVer=string       Set the operatingSystemVersion attribute during the join.\n"
1282                    "                      NB: osName and osVer must be specified together for either to take effect.\n"
1283                    "                          Also, the operatingSystemService attribute is also set when along with\n"
1284                    "                          the two other attributes.\n"));
1285
1286         return -1;
1287 }
1288
1289 /*******************************************************************
1290  ********************************************************************/
1291
1292 int net_ads_join(struct net_context *c, int argc, const char **argv)
1293 {
1294         TALLOC_CTX *ctx = NULL;
1295         struct libnet_JoinCtx *r = NULL;
1296         const char *domain = lp_realm();
1297         WERROR werr = WERR_SETUP_NOT_JOINED;
1298         bool createupn = false;
1299         const char *machineupn = NULL;
1300         const char *create_in_ou = NULL;
1301         int i;
1302         const char *os_name = NULL;
1303         const char *os_version = NULL;
1304         bool modify_config = lp_config_backend_is_registry();
1305
1306         if (c->display_usage)
1307                 return net_ads_join_usage(c, argc, argv);
1308
1309         if (!modify_config) {
1310
1311                 werr = check_ads_config();
1312                 if (!W_ERROR_IS_OK(werr)) {
1313                         d_fprintf(stderr, _("Invalid configuration.  Exiting....\n"));
1314                         goto fail;
1315                 }
1316         }
1317
1318         if (!(ctx = talloc_init("net_ads_join"))) {
1319                 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
1320                 werr = WERR_NOMEM;
1321                 goto fail;
1322         }
1323
1324         if (!c->opt_kerberos) {
1325                 use_in_memory_ccache();
1326         }
1327
1328         werr = libnet_init_JoinCtx(ctx, &r);
1329         if (!W_ERROR_IS_OK(werr)) {
1330                 goto fail;
1331         }
1332
1333         /* process additional command line args */
1334
1335         for ( i=0; i<argc; i++ ) {
1336                 if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
1337                         createupn = true;
1338                         machineupn = get_string_param(argv[i]);
1339                 }
1340                 else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
1341                         if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
1342                                 d_fprintf(stderr, _("Please supply a valid OU path.\n"));
1343                                 werr = WERR_INVALID_PARAM;
1344                                 goto fail;
1345                         }
1346                 }
1347                 else if ( !StrnCaseCmp(argv[i], "osName", strlen("osName")) ) {
1348                         if ( (os_name = get_string_param(argv[i])) == NULL ) {
1349                                 d_fprintf(stderr, _("Please supply a operating system name.\n"));
1350                                 werr = WERR_INVALID_PARAM;
1351                                 goto fail;
1352                         }
1353                 }
1354                 else if ( !StrnCaseCmp(argv[i], "osVer", strlen("osVer")) ) {
1355                         if ( (os_version = get_string_param(argv[i])) == NULL ) {
1356                                 d_fprintf(stderr, _("Please supply a valid operating system version.\n"));
1357                                 werr = WERR_INVALID_PARAM;
1358                                 goto fail;
1359                         }
1360                 }
1361                 else {
1362                         domain = argv[i];
1363                 }
1364         }
1365
1366         if (!*domain) {
1367                 d_fprintf(stderr, _("Please supply a valid domain name\n"));
1368                 werr = WERR_INVALID_PARAM;
1369                 goto fail;
1370         }
1371
1372         if (!c->msg_ctx) {
1373                 d_fprintf(stderr, _("Could not initialise message context. "
1374                         "Try running as root\n"));
1375                 werr = WERR_ACCESS_DENIED;
1376                 goto fail;
1377         }
1378
1379         /* Do the domain join here */
1380
1381         r->in.domain_name       = domain;
1382         r->in.create_upn        = createupn;
1383         r->in.upn               = machineupn;
1384         r->in.account_ou        = create_in_ou;
1385         r->in.os_name           = os_name;
1386         r->in.os_version        = os_version;
1387         r->in.dc_name           = c->opt_host;
1388         r->in.admin_account     = c->opt_user_name;
1389         r->in.admin_password    = net_prompt_pass(c, c->opt_user_name);
1390         r->in.debug             = true;
1391         r->in.use_kerberos      = c->opt_kerberos;
1392         r->in.modify_config     = modify_config;
1393         r->in.join_flags        = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1394                                   WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
1395                                   WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
1396         r->in.msg_ctx           = c->msg_ctx;
1397
1398         werr = libnet_Join(ctx, r);
1399         if (!W_ERROR_IS_OK(werr)) {
1400                 goto fail;
1401         }
1402
1403         /* Check the short name of the domain */
1404
1405         if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
1406                 d_printf(_("The workgroup in %s does not match the short\n"
1407                            "domain name obtained from the server.\n"
1408                            "Using the name [%s] from the server.\n"
1409                            "You should set \"workgroup = %s\" in %s.\n"),
1410                          get_dyn_CONFIGFILE(), r->out.netbios_domain_name,
1411                          r->out.netbios_domain_name, get_dyn_CONFIGFILE());
1412         }
1413
1414         d_printf(_("Using short domain name -- %s\n"), r->out.netbios_domain_name);
1415
1416         if (r->out.dns_domain_name) {
1417                 d_printf(_("Joined '%s' to realm '%s'\n"), r->in.machine_name,
1418                         r->out.dns_domain_name);
1419         } else {
1420                 d_printf(_("Joined '%s' to domain '%s'\n"), r->in.machine_name,
1421                         r->out.netbios_domain_name);
1422         }
1423
1424 #if defined(WITH_DNS_UPDATES)
1425         /*
1426          * In a clustered environment, don't do dynamic dns updates:
1427          * Registering the set of ip addresses that are assigned to
1428          * the interfaces of the node that performs the join does usually
1429          * not have the desired effect, since the local interfaces do not
1430          * carry the complete set of the cluster's public IP addresses.
1431          * And it can also contain internal addresses that should not
1432          * be visible to the outside at all.
1433          * In order to do dns updates in a clustererd setup, use
1434          * net ads dns register.
1435          */
1436         if (lp_clustering()) {
1437                 d_fprintf(stderr, _("Not doing automatic DNS update in a"
1438                                     "clustered setup.\n"));
1439                 goto done;
1440         }
1441
1442         if (r->out.domain_is_ad) {
1443                 /* We enter this block with user creds */
1444                 ADS_STRUCT *ads_dns = NULL;
1445
1446                 if ( (ads_dns = ads_init( lp_realm(), NULL, NULL )) != NULL ) {
1447                         /* kinit with the machine password */
1448
1449                         use_in_memory_ccache();
1450                         if (asprintf( &ads_dns->auth.user_name, "%s$", global_myname()) == -1) {
1451                                 goto fail;
1452                         }
1453                         ads_dns->auth.password = secrets_fetch_machine_password(
1454                                 r->out.netbios_domain_name, NULL, NULL );
1455                         ads_dns->auth.realm = SMB_STRDUP( r->out.dns_domain_name );
1456                         strupper_m(ads_dns->auth.realm );
1457                         ads_kinit_password( ads_dns );
1458                 }
1459
1460                 if ( !ads_dns || !NT_STATUS_IS_OK(net_update_dns( ctx, ads_dns, NULL)) ) {
1461                         d_fprintf( stderr, _("DNS update failed!\n") );
1462                 }
1463
1464                 /* exit from this block using machine creds */
1465                 ads_destroy(&ads_dns);
1466         }
1467 #endif
1468
1469 done:
1470         TALLOC_FREE(r);
1471         TALLOC_FREE( ctx );
1472
1473         return 0;
1474
1475 fail:
1476         /* issue an overall failure message at the end. */
1477         d_printf(_("Failed to join domain: %s\n"),
1478                 r && r->out.error_string ? r->out.error_string :
1479                 get_friendly_werror_msg(werr));
1480         TALLOC_FREE( ctx );
1481
1482         return -1;
1483 }
1484
1485 /*******************************************************************
1486  ********************************************************************/
1487
1488 static int net_ads_dns_register(struct net_context *c, int argc, const char **argv)
1489 {
1490 #if defined(WITH_DNS_UPDATES)
1491         ADS_STRUCT *ads;
1492         ADS_STATUS status;
1493         NTSTATUS ntstatus;
1494         TALLOC_CTX *ctx;
1495         const char *hostname = NULL;
1496         const char **addrs_list = NULL;
1497         struct sockaddr_storage *addrs = NULL;
1498         int num_addrs = 0;
1499         int count;
1500
1501 #ifdef DEVELOPER
1502         talloc_enable_leak_report();
1503 #endif
1504
1505         if (argc <= 1 && lp_clustering() && lp_cluster_addresses() == NULL) {
1506                 d_fprintf(stderr, _("Refusing DNS updates with automatic "
1507                                     "detection of addresses in a clustered "
1508                                     "setup.\n"));
1509                 c->display_usage = true;
1510         }
1511
1512         if (c->display_usage) {
1513                 d_printf(  "%s\n"
1514                            "net ads dns register [hostname [IP [IP...]]]\n"
1515                            "    %s\n",
1516                          _("Usage:"),
1517                          _("Register hostname with DNS\n"));
1518                 return -1;
1519         }
1520
1521         if (!(ctx = talloc_init("net_ads_dns"))) {
1522                 d_fprintf(stderr, _("Could not initialise talloc context\n"));
1523                 return -1;
1524         }
1525
1526         if (argc >= 1) {
1527                 hostname = argv[0];
1528         }
1529
1530         if (argc > 1) {
1531                 num_addrs = argc - 1;
1532                 addrs_list = &argv[1];
1533         } else if (lp_clustering()) {
1534                 addrs_list = lp_cluster_addresses();
1535                 num_addrs = str_list_length(addrs_list);
1536         }
1537
1538         if (num_addrs > 0) {
1539                 addrs = talloc_zero_array(ctx, struct sockaddr_storage, num_addrs);
1540                 if (addrs == NULL) {
1541                         d_fprintf(stderr, _("Error allocating memory!\n"));
1542                         talloc_free(ctx);
1543                         return -1;
1544                 }
1545         }
1546
1547         for (count = 0; count < num_addrs; count++) {
1548                 if (!interpret_string_addr(&addrs[count], addrs_list[count], 0)) {
1549                         d_fprintf(stderr, "%s '%s'.\n",
1550                                           _("Cannot interpret address"),
1551                                           addrs_list[count]);
1552                         talloc_free(ctx);
1553                         return -1;
1554                 }
1555         }
1556
1557         status = ads_startup(c, true, &ads);
1558         if ( !ADS_ERR_OK(status) ) {
1559                 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status)));
1560                 TALLOC_FREE(ctx);
1561                 return -1;
1562         }
1563
1564         ntstatus = net_update_dns_ext(ctx, ads, hostname, addrs, num_addrs);
1565         if (!NT_STATUS_IS_OK(ntstatus)) {
1566                 d_fprintf( stderr, _("DNS update failed!\n") );
1567                 ads_destroy( &ads );
1568                 TALLOC_FREE( ctx );
1569                 return -1;
1570         }
1571
1572         d_fprintf( stderr, _("Successfully registered hostname with DNS\n") );
1573
1574         ads_destroy(&ads);
1575         TALLOC_FREE( ctx );
1576
1577         return 0;
1578 #else
1579         d_fprintf(stderr,
1580                   _("DNS update support not enabled at compile time!\n"));
1581         return -1;
1582 #endif
1583 }
1584
1585 #if defined(WITH_DNS_UPDATES)
1586 DNS_ERROR do_gethostbyname(const char *server, const char *host);
1587 #endif
1588
1589 static int net_ads_dns_gethostbyname(struct net_context *c, int argc, const char **argv)
1590 {
1591 #if defined(WITH_DNS_UPDATES)
1592         DNS_ERROR err;
1593
1594 #ifdef DEVELOPER
1595         talloc_enable_leak_report();
1596 #endif
1597
1598         if (argc != 2 || c->display_usage) {
1599                 d_printf(  "%s\n"
1600                            "    %s\n"
1601                            "    %s\n",
1602                          _("Usage:"),
1603                          _("net ads dns gethostbyname <server> <name>\n"),
1604                          _("  Look up hostname from the AD\n"
1605                            "    server\tName server to use\n"
1606                            "    name\tName to look up\n"));
1607                 return -1;
1608         }
1609
1610         err = do_gethostbyname(argv[0], argv[1]);
1611
1612         d_printf(_("do_gethostbyname returned %s (%d)\n"),
1613                 dns_errstr(err), ERROR_DNS_V(err));
1614 #endif
1615         return 0;
1616 }
1617
1618 static int net_ads_dns(struct net_context *c, int argc, const char *argv[])
1619 {
1620         struct functable func[] = {
1621                 {
1622                         "register",
1623                         net_ads_dns_register,
1624                         NET_TRANSPORT_ADS,
1625                         N_("Add host dns entry to AD"),
1626                         N_("net ads dns register\n"
1627                            "    Add host dns entry to AD")
1628                 },
1629                 {
1630                         "gethostbyname",
1631                         net_ads_dns_gethostbyname,
1632                         NET_TRANSPORT_ADS,
1633                         N_("Look up host"),
1634                         N_("net ads dns gethostbyname\n"
1635                            "    Look up host")
1636                 },
1637                 {NULL, NULL, 0, NULL, NULL}
1638         };
1639
1640         return net_run_function(c, argc, argv, "net ads dns", func);
1641 }
1642
1643 /*******************************************************************
1644  ********************************************************************/
1645
1646 int net_ads_printer_usage(struct net_context *c, int argc, const char **argv)
1647 {
1648         d_printf(_(
1649 "\nnet ads printer search <printer>"
1650 "\n\tsearch for a printer in the directory\n"
1651 "\nnet ads printer info <printer> <server>"
1652 "\n\tlookup info in directory for printer on server"
1653 "\n\t(note: printer defaults to \"*\", server defaults to local)\n"
1654 "\nnet ads printer publish <printername>"
1655 "\n\tpublish printer in directory"
1656 "\n\t(note: printer name is required)\n"
1657 "\nnet ads printer remove <printername>"
1658 "\n\tremove printer from directory"
1659 "\n\t(note: printer name is required)\n"));
1660         return -1;
1661 }
1662
1663 /*******************************************************************
1664  ********************************************************************/
1665
1666 static int net_ads_printer_search(struct net_context *c, int argc, const char **argv)
1667 {
1668         ADS_STRUCT *ads;
1669         ADS_STATUS rc;
1670         LDAPMessage *res = NULL;
1671
1672         if (c->display_usage) {
1673                 d_printf(  "%s\n"
1674                            "net ads printer search\n"
1675                            "    %s\n",
1676                          _("Usage:"),
1677                          _("List printers in the AD"));
1678                 return 0;
1679         }
1680
1681         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1682                 return -1;
1683         }
1684
1685         rc = ads_find_printers(ads, &res);
1686
1687         if (!ADS_ERR_OK(rc)) {
1688                 d_fprintf(stderr, _("ads_find_printer: %s\n"), ads_errstr(rc));
1689                 ads_msgfree(ads, res);
1690                 ads_destroy(&ads);
1691                 return -1;
1692         }
1693
1694         if (ads_count_replies(ads, res) == 0) {
1695                 d_fprintf(stderr, _("No results found\n"));
1696                 ads_msgfree(ads, res);
1697                 ads_destroy(&ads);
1698                 return -1;
1699         }
1700
1701         ads_dump(ads, res);
1702         ads_msgfree(ads, res);
1703         ads_destroy(&ads);
1704         return 0;
1705 }
1706
1707 static int net_ads_printer_info(struct net_context *c, int argc, const char **argv)
1708 {
1709         ADS_STRUCT *ads;
1710         ADS_STATUS rc;
1711         const char *servername, *printername;
1712         LDAPMessage *res = NULL;
1713
1714         if (c->display_usage) {
1715                 d_printf("%s\n%s",
1716                          _("Usage:"),
1717                          _("net ads printer info [printername [servername]]\n"
1718                            "  Display printer info from AD\n"
1719                            "    printername\tPrinter name or wildcard\n"
1720                            "    servername\tName of the print server\n"));
1721                 return 0;
1722         }
1723
1724         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1725                 return -1;
1726         }
1727
1728         if (argc > 0) {
1729                 printername = argv[0];
1730         } else {
1731                 printername = "*";
1732         }
1733
1734         if (argc > 1) {
1735                 servername =  argv[1];
1736         } else {
1737                 servername = global_myname();
1738         }
1739
1740         rc = ads_find_printer_on_server(ads, &res, printername, servername);
1741
1742         if (!ADS_ERR_OK(rc)) {
1743                 d_fprintf(stderr, _("Server '%s' not found: %s\n"),
1744                         servername, ads_errstr(rc));
1745                 ads_msgfree(ads, res);
1746                 ads_destroy(&ads);
1747                 return -1;
1748         }
1749
1750         if (ads_count_replies(ads, res) == 0) {
1751                 d_fprintf(stderr, _("Printer '%s' not found\n"), printername);
1752                 ads_msgfree(ads, res);
1753                 ads_destroy(&ads);
1754                 return -1;
1755         }
1756
1757         ads_dump(ads, res);
1758         ads_msgfree(ads, res);
1759         ads_destroy(&ads);
1760
1761         return 0;
1762 }
1763
1764 static int net_ads_printer_publish(struct net_context *c, int argc, const char **argv)
1765 {
1766         ADS_STRUCT *ads;
1767         ADS_STATUS rc;
1768         const char *servername, *printername;
1769         struct cli_state *cli = NULL;
1770         struct rpc_pipe_client *pipe_hnd = NULL;
1771         struct sockaddr_storage server_ss;
1772         NTSTATUS nt_status;
1773         TALLOC_CTX *mem_ctx = talloc_init("net_ads_printer_publish");
1774         ADS_MODLIST mods = ads_init_mods(mem_ctx);
1775         char *prt_dn, *srv_dn, **srv_cn;
1776         char *srv_cn_escaped = NULL, *printername_escaped = NULL;
1777         LDAPMessage *res = NULL;
1778
1779         if (argc < 1 || c->display_usage) {
1780                 d_printf("%s\n%s",
1781                          _("Usage:"),
1782                          _("net ads printer publish <printername> [servername]\n"
1783                            "  Publish printer in AD\n"
1784                            "    printername\tName of the printer\n"
1785                            "    servername\tName of the print server\n"));
1786                 talloc_destroy(mem_ctx);
1787                 return -1;
1788         }
1789
1790         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1791                 talloc_destroy(mem_ctx);
1792                 return -1;
1793         }
1794
1795         printername = argv[0];
1796
1797         if (argc == 2) {
1798                 servername = argv[1];
1799         } else {
1800                 servername = global_myname();
1801         }
1802
1803         /* Get printer data from SPOOLSS */
1804
1805         resolve_name(servername, &server_ss, 0x20, false);
1806
1807         nt_status = cli_full_connection(&cli, global_myname(), servername,
1808                                         &server_ss, 0,
1809                                         "IPC$", "IPC",
1810                                         c->opt_user_name, c->opt_workgroup,
1811                                         c->opt_password ? c->opt_password : "",
1812                                         CLI_FULL_CONNECTION_USE_KERBEROS,
1813                                         Undefined);
1814
1815         if (NT_STATUS_IS_ERR(nt_status)) {
1816                 d_fprintf(stderr, _("Unable to open a connnection to %s to "
1817                                     "obtain data for %s\n"),
1818                           servername, printername);
1819                 ads_destroy(&ads);
1820                 talloc_destroy(mem_ctx);
1821                 return -1;
1822         }
1823
1824         /* Publish on AD server */
1825
1826         ads_find_machine_acct(ads, &res, servername);
1827
1828         if (ads_count_replies(ads, res) == 0) {
1829                 d_fprintf(stderr, _("Could not find machine account for server "
1830                                     "%s\n"),
1831                          servername);
1832                 ads_destroy(&ads);
1833                 talloc_destroy(mem_ctx);
1834                 return -1;
1835         }
1836
1837         srv_dn = ldap_get_dn((LDAP *)ads->ldap.ld, (LDAPMessage *)res);
1838         srv_cn = ldap_explode_dn(srv_dn, 1);
1839
1840         srv_cn_escaped = escape_rdn_val_string_alloc(srv_cn[0]);
1841         printername_escaped = escape_rdn_val_string_alloc(printername);
1842         if (!srv_cn_escaped || !printername_escaped) {
1843                 SAFE_FREE(srv_cn_escaped);
1844                 SAFE_FREE(printername_escaped);
1845                 d_fprintf(stderr, _("Internal error, out of memory!"));
1846                 ads_destroy(&ads);
1847                 talloc_destroy(mem_ctx);
1848                 return -1;
1849         }
1850
1851         if (asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn_escaped, printername_escaped, srv_dn) == -1) {
1852                 SAFE_FREE(srv_cn_escaped);
1853                 SAFE_FREE(printername_escaped);
1854                 d_fprintf(stderr, _("Internal error, out of memory!"));
1855                 ads_destroy(&ads);
1856                 talloc_destroy(mem_ctx);
1857                 return -1;
1858         }
1859
1860         SAFE_FREE(srv_cn_escaped);
1861         SAFE_FREE(printername_escaped);
1862
1863         nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_spoolss.syntax_id, &pipe_hnd);
1864         if (!NT_STATUS_IS_OK(nt_status)) {
1865                 d_fprintf(stderr, _("Unable to open a connnection to the spoolss pipe on %s\n"),
1866                          servername);
1867                 SAFE_FREE(prt_dn);
1868                 ads_destroy(&ads);
1869                 talloc_destroy(mem_ctx);
1870                 return -1;
1871         }
1872
1873         if (!W_ERROR_IS_OK(get_remote_printer_publishing_data(pipe_hnd, mem_ctx, &mods,
1874                                                               printername))) {
1875                 SAFE_FREE(prt_dn);
1876                 ads_destroy(&ads);
1877                 talloc_destroy(mem_ctx);
1878                 return -1;
1879         }
1880
1881         rc = ads_add_printer_entry(ads, prt_dn, mem_ctx, &mods);
1882         if (!ADS_ERR_OK(rc)) {
1883                 d_fprintf(stderr, "ads_publish_printer: %s\n", ads_errstr(rc));
1884                 SAFE_FREE(prt_dn);
1885                 ads_destroy(&ads);
1886                 talloc_destroy(mem_ctx);
1887                 return -1;
1888         }
1889
1890         d_printf("published printer\n");
1891         SAFE_FREE(prt_dn);
1892         ads_destroy(&ads);
1893         talloc_destroy(mem_ctx);
1894
1895         return 0;
1896 }
1897
1898 static int net_ads_printer_remove(struct net_context *c, int argc, const char **argv)
1899 {
1900         ADS_STRUCT *ads;
1901         ADS_STATUS rc;
1902         const char *servername;
1903         char *prt_dn;
1904         LDAPMessage *res = NULL;
1905
1906         if (argc < 1 || c->display_usage) {
1907                 d_printf("%s\n%s",
1908                          _("Usage:"),
1909                          _("net ads printer remove <printername> [servername]\n"
1910                            "  Remove a printer from the AD\n"
1911                            "    printername\tName of the printer\n"
1912                            "    servername\tName of the print server\n"));
1913                 return -1;
1914         }
1915
1916         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1917                 return -1;
1918         }
1919
1920         if (argc > 1) {
1921                 servername = argv[1];
1922         } else {
1923                 servername = global_myname();
1924         }
1925
1926         rc = ads_find_printer_on_server(ads, &res, argv[0], servername);
1927
1928         if (!ADS_ERR_OK(rc)) {
1929                 d_fprintf(stderr, _("ads_find_printer_on_server: %s\n"), ads_errstr(rc));
1930                 ads_msgfree(ads, res);
1931                 ads_destroy(&ads);
1932                 return -1;
1933         }
1934
1935         if (ads_count_replies(ads, res) == 0) {
1936                 d_fprintf(stderr, _("Printer '%s' not found\n"), argv[1]);
1937                 ads_msgfree(ads, res);
1938                 ads_destroy(&ads);
1939                 return -1;
1940         }
1941
1942         prt_dn = ads_get_dn(ads, talloc_tos(), res);
1943         ads_msgfree(ads, res);
1944         rc = ads_del_dn(ads, prt_dn);
1945         TALLOC_FREE(prt_dn);
1946
1947         if (!ADS_ERR_OK(rc)) {
1948                 d_fprintf(stderr, _("ads_del_dn: %s\n"), ads_errstr(rc));
1949                 ads_destroy(&ads);
1950                 return -1;
1951         }
1952
1953         ads_destroy(&ads);
1954         return 0;
1955 }
1956
1957 static int net_ads_printer(struct net_context *c, int argc, const char **argv)
1958 {
1959         struct functable func[] = {
1960                 {
1961                         "search",
1962                         net_ads_printer_search,
1963                         NET_TRANSPORT_ADS,
1964                         N_("Search for a printer"),
1965                         N_("net ads printer search\n"
1966                            "    Search for a printer")
1967                 },
1968                 {
1969                         "info",
1970                         net_ads_printer_info,
1971                         NET_TRANSPORT_ADS,
1972                         N_("Display printer information"),
1973                         N_("net ads printer info\n"
1974                            "    Display printer information")
1975                 },
1976                 {
1977                         "publish",
1978                         net_ads_printer_publish,
1979                         NET_TRANSPORT_ADS,
1980                         N_("Publish a printer"),
1981                         N_("net ads printer publish\n"
1982                            "    Publish a printer")
1983                 },
1984                 {
1985                         "remove",
1986                         net_ads_printer_remove,
1987                         NET_TRANSPORT_ADS,
1988                         N_("Delete a printer"),
1989                         N_("net ads printer remove\n"
1990                            "    Delete a printer")
1991                 },
1992                 {NULL, NULL, 0, NULL, NULL}
1993         };
1994
1995         return net_run_function(c, argc, argv, "net ads printer", func);
1996 }
1997
1998
1999 static int net_ads_password(struct net_context *c, int argc, const char **argv)
2000 {
2001         ADS_STRUCT *ads;
2002         const char *auth_principal = c->opt_user_name;
2003         const char *auth_password = c->opt_password;
2004         char *realm = NULL;
2005         char *new_password = NULL;
2006         char *chr, *prompt;
2007         const char *user;
2008         ADS_STATUS ret;
2009
2010         if (c->display_usage) {
2011                 d_printf("%s\n%s",
2012                          _("Usage:"),
2013                          _("net ads password <username>\n"
2014                            "  Change password for user\n"
2015                            "    username\tName of user to change password for\n"));
2016                 return 0;
2017         }
2018
2019         if (c->opt_user_name == NULL || c->opt_password == NULL) {
2020                 d_fprintf(stderr, _("You must supply an administrator "
2021                                     "username/password\n"));
2022                 return -1;
2023         }
2024
2025         if (argc < 1) {
2026                 d_fprintf(stderr, _("ERROR: You must say which username to "
2027                                     "change password for\n"));
2028                 return -1;
2029         }
2030
2031         user = argv[0];
2032         if (!strchr_m(user, '@')) {
2033                 if (asprintf(&chr, "%s@%s", argv[0], lp_realm()) == -1) {
2034                         return -1;
2035                 }
2036                 user = chr;
2037         }
2038
2039         use_in_memory_ccache();
2040         chr = strchr_m(auth_principal, '@');
2041         if (chr) {
2042                 realm = ++chr;
2043         } else {
2044                 realm = lp_realm();
2045         }
2046
2047         /* use the realm so we can eventually change passwords for users
2048         in realms other than default */
2049         if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) {
2050                 return -1;
2051         }
2052
2053         /* we don't actually need a full connect, but it's the easy way to
2054                 fill in the KDC's addresss */
2055         ads_connect(ads);
2056
2057         if (!ads->config.realm) {
2058                 d_fprintf(stderr, _("Didn't find the kerberos server!\n"));
2059                 ads_destroy(&ads);
2060                 return -1;
2061         }
2062
2063         if (argv[1]) {
2064                 new_password = (char *)argv[1];
2065         } else {
2066                 if (asprintf(&prompt, _("Enter new password for %s:"), user) == -1) {
2067                         return -1;
2068                 }
2069                 new_password = getpass(prompt);
2070                 free(prompt);
2071         }
2072
2073         ret = kerberos_set_password(ads->auth.kdc_server, auth_principal,
2074                                 auth_password, user, new_password, ads->auth.time_offset);
2075         if (!ADS_ERR_OK(ret)) {
2076                 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2077                 ads_destroy(&ads);
2078                 return -1;
2079         }
2080
2081         d_printf(_("Password change for %s completed.\n"), user);
2082         ads_destroy(&ads);
2083
2084         return 0;
2085 }
2086
2087 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2088 {
2089         ADS_STRUCT *ads;
2090         char *host_principal;
2091         fstring my_name;
2092         ADS_STATUS ret;
2093
2094         if (c->display_usage) {
2095                 d_printf(  "%s\n"
2096                            "net ads changetrustpw\n"
2097                            "    %s\n",
2098                          _("Usage:"),
2099                          _("Change the machine account's trust password"));
2100                 return 0;
2101         }
2102
2103         if (!secrets_init()) {
2104                 DEBUG(1,("Failed to initialise secrets database\n"));
2105                 return -1;
2106         }
2107
2108         net_use_krb_machine_account(c);
2109
2110         use_in_memory_ccache();
2111
2112         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2113                 return -1;
2114         }
2115
2116         fstrcpy(my_name, global_myname());
2117         strlower_m(my_name);
2118         if (asprintf(&host_principal, "%s$@%s", my_name, ads->config.realm) == -1) {
2119                 ads_destroy(&ads);
2120                 return -1;
2121         }
2122         d_printf(_("Changing password for principal: %s\n"), host_principal);
2123
2124         ret = ads_change_trust_account_password(ads, host_principal);
2125
2126         if (!ADS_ERR_OK(ret)) {
2127                 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2128                 ads_destroy(&ads);
2129                 SAFE_FREE(host_principal);
2130                 return -1;
2131         }
2132
2133         d_printf(_("Password change for principal %s succeeded.\n"), host_principal);
2134
2135         if (USE_SYSTEM_KEYTAB) {
2136                 d_printf(_("Attempting to update system keytab with new password.\n"));
2137                 if (ads_keytab_create_default(ads)) {
2138                         d_printf(_("Failed to update system keytab.\n"));
2139                 }
2140         }
2141
2142         ads_destroy(&ads);
2143         SAFE_FREE(host_principal);
2144
2145         return 0;
2146 }
2147
2148 /*
2149   help for net ads search
2150 */
2151 static int net_ads_search_usage(struct net_context *c, int argc, const char **argv)
2152 {
2153         d_printf(_(
2154                 "\nnet ads search <expression> <attributes...>\n"
2155                 "\nPerform a raw LDAP search on a ADS server and dump the results.\n"
2156                 "The expression is a standard LDAP search expression, and the\n"
2157                 "attributes are a list of LDAP fields to show in the results.\n\n"
2158                 "Example: net ads search '(objectCategory=group)' sAMAccountName\n\n"
2159                 ));
2160         net_common_flags_usage(c, argc, argv);
2161         return -1;
2162 }
2163
2164
2165 /*
2166   general ADS search function. Useful in diagnosing problems in ADS
2167 */
2168 static int net_ads_search(struct net_context *c, int argc, const char **argv)
2169 {
2170         ADS_STRUCT *ads;
2171         ADS_STATUS rc;
2172         const char *ldap_exp;
2173         const char **attrs;
2174         LDAPMessage *res = NULL;
2175
2176         if (argc < 1 || c->display_usage) {
2177                 return net_ads_search_usage(c, argc, argv);
2178         }
2179
2180         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2181                 return -1;
2182         }
2183
2184         ldap_exp = argv[0];
2185         attrs = (argv + 1);
2186
2187         rc = ads_do_search_all(ads, ads->config.bind_path,
2188                                LDAP_SCOPE_SUBTREE,
2189                                ldap_exp, attrs, &res);
2190         if (!ADS_ERR_OK(rc)) {
2191                 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2192                 ads_destroy(&ads);
2193                 return -1;
2194         }
2195
2196         d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2197
2198         /* dump the results */
2199         ads_dump(ads, res);
2200
2201         ads_msgfree(ads, res);
2202         ads_destroy(&ads);
2203
2204         return 0;
2205 }
2206
2207
2208 /*
2209   help for net ads search
2210 */
2211 static int net_ads_dn_usage(struct net_context *c, int argc, const char **argv)
2212 {
2213         d_printf(_(
2214                 "\nnet ads dn <dn> <attributes...>\n"
2215                 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2216                 "The DN standard LDAP DN, and the attributes are a list of LDAP fields \n"
2217                 "to show in the results\n\n"
2218                 "Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' sAMAccountName\n\n"
2219                 "Note: the DN must be provided properly escaped. See RFC 4514 for details\n\n"
2220                 ));
2221         net_common_flags_usage(c, argc, argv);
2222         return -1;
2223 }
2224
2225
2226 /*
2227   general ADS search function. Useful in diagnosing problems in ADS
2228 */
2229 static int net_ads_dn(struct net_context *c, int argc, const char **argv)
2230 {
2231         ADS_STRUCT *ads;
2232         ADS_STATUS rc;
2233         const char *dn;
2234         const char **attrs;
2235         LDAPMessage *res = NULL;
2236
2237         if (argc < 1 || c->display_usage) {
2238                 return net_ads_dn_usage(c, argc, argv);
2239         }
2240
2241         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2242                 return -1;
2243         }
2244
2245         dn = argv[0];
2246         attrs = (argv + 1);
2247
2248         rc = ads_do_search_all(ads, dn,
2249                                LDAP_SCOPE_BASE,
2250                                "(objectclass=*)", attrs, &res);
2251         if (!ADS_ERR_OK(rc)) {
2252                 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2253                 ads_destroy(&ads);
2254                 return -1;
2255         }
2256
2257         d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2258
2259         /* dump the results */
2260         ads_dump(ads, res);
2261
2262         ads_msgfree(ads, res);
2263         ads_destroy(&ads);
2264
2265         return 0;
2266 }
2267
2268 /*
2269   help for net ads sid search
2270 */
2271 static int net_ads_sid_usage(struct net_context *c, int argc, const char **argv)
2272 {
2273         d_printf(_(
2274                 "\nnet ads sid <sid> <attributes...>\n"
2275                 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2276                 "The SID is in string format, and the attributes are a list of LDAP fields \n"
2277                 "to show in the results\n\n"
2278                 "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
2279                 ));
2280         net_common_flags_usage(c, argc, argv);
2281         return -1;
2282 }
2283
2284
2285 /*
2286   general ADS search function. Useful in diagnosing problems in ADS
2287 */
2288 static int net_ads_sid(struct net_context *c, int argc, const char **argv)
2289 {
2290         ADS_STRUCT *ads;
2291         ADS_STATUS rc;
2292         const char *sid_string;
2293         const char **attrs;
2294         LDAPMessage *res = NULL;
2295         struct dom_sid sid;
2296
2297         if (argc < 1 || c->display_usage) {
2298                 return net_ads_sid_usage(c, argc, argv);
2299         }
2300
2301         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2302                 return -1;
2303         }
2304
2305         sid_string = argv[0];
2306         attrs = (argv + 1);
2307
2308         if (!string_to_sid(&sid, sid_string)) {
2309                 d_fprintf(stderr, _("could not convert sid\n"));
2310                 ads_destroy(&ads);
2311                 return -1;
2312         }
2313
2314         rc = ads_search_retry_sid(ads, &res, &sid, attrs);
2315         if (!ADS_ERR_OK(rc)) {
2316                 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2317                 ads_destroy(&ads);
2318                 return -1;
2319         }
2320
2321         d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2322
2323         /* dump the results */
2324         ads_dump(ads, res);
2325
2326         ads_msgfree(ads, res);
2327         ads_destroy(&ads);
2328
2329         return 0;
2330 }
2331
2332 static int net_ads_keytab_flush(struct net_context *c, int argc, const char **argv)
2333 {
2334         int ret;
2335         ADS_STRUCT *ads;
2336
2337         if (c->display_usage) {
2338                 d_printf(  "%s\n"
2339                            "net ads keytab flush\n"
2340                            "    %s\n",
2341                          _("Usage:"),
2342                          _("Delete the whole keytab"));
2343                 return 0;
2344         }
2345
2346         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2347                 return -1;
2348         }
2349         ret = ads_keytab_flush(ads);
2350         ads_destroy(&ads);
2351         return ret;
2352 }
2353
2354 static int net_ads_keytab_add(struct net_context *c, int argc, const char **argv)
2355 {
2356         int i;
2357         int ret = 0;
2358         ADS_STRUCT *ads;
2359
2360         if (c->display_usage) {
2361                 d_printf("%s\n%s",
2362                          _("Usage:"),
2363                          _("net ads keytab add <principal> [principal ...]\n"
2364                            "  Add principals to local keytab\n"
2365                            "    principal\tKerberos principal to add to "
2366                            "keytab\n"));
2367                 return 0;
2368         }
2369
2370         d_printf(_("Processing principals to add...\n"));
2371         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2372                 return -1;
2373         }
2374         for (i = 0; i < argc; i++) {
2375                 ret |= ads_keytab_add_entry(ads, argv[i]);
2376         }
2377         ads_destroy(&ads);
2378         return ret;
2379 }
2380
2381 static int net_ads_keytab_create(struct net_context *c, int argc, const char **argv)
2382 {
2383         ADS_STRUCT *ads;
2384         int ret;
2385
2386         if (c->display_usage) {
2387                 d_printf(  "%s\n"
2388                            "net ads keytab create\n"
2389                            "    %s\n",
2390                          _("Usage:"),
2391                          _("Create new default keytab"));
2392                 return 0;
2393         }
2394
2395         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2396                 return -1;
2397         }
2398         ret = ads_keytab_create_default(ads);
2399         ads_destroy(&ads);
2400         return ret;
2401 }
2402
2403 static int net_ads_keytab_list(struct net_context *c, int argc, const char **argv)
2404 {
2405         const char *keytab = NULL;
2406
2407         if (c->display_usage) {
2408                 d_printf("%s\n%s",
2409                          _("Usage:"),
2410                          _("net ads keytab list [keytab]\n"
2411                            "  List a local keytab\n"
2412                            "    keytab\tKeytab to list\n"));
2413                 return 0;
2414         }
2415
2416         if (argc >= 1) {
2417                 keytab = argv[0];
2418         }
2419
2420         return ads_keytab_list(keytab);
2421 }
2422
2423
2424 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2425 {
2426         struct functable func[] = {
2427                 {
2428                         "add",
2429                         net_ads_keytab_add,
2430                         NET_TRANSPORT_ADS,
2431                         N_("Add a service principal"),
2432                         N_("net ads keytab add\n"
2433                            "    Add a service principal")
2434                 },
2435                 {
2436                         "create",
2437                         net_ads_keytab_create,
2438                         NET_TRANSPORT_ADS,
2439                         N_("Create a fresh keytab"),
2440                         N_("net ads keytab create\n"
2441                            "    Create a fresh keytab")
2442                 },
2443                 {
2444                         "flush",
2445                         net_ads_keytab_flush,
2446                         NET_TRANSPORT_ADS,
2447                         N_("Remove all keytab entries"),
2448                         N_("net ads keytab flush\n"
2449                            "    Remove all keytab entries")
2450                 },
2451                 {
2452                         "list",
2453                         net_ads_keytab_list,
2454                         NET_TRANSPORT_ADS,
2455                         N_("List a keytab"),
2456                         N_("net ads keytab list\n"
2457                            "    List a keytab")
2458                 },
2459                 {NULL, NULL, 0, NULL, NULL}
2460         };
2461
2462         if (!USE_KERBEROS_KEYTAB) {
2463                 d_printf(_("\nWarning: \"kerberos method\" must be set to a "
2464                     "keytab method to use keytab functions.\n"));
2465         }
2466
2467         return net_run_function(c, argc, argv, "net ads keytab", func);
2468 }
2469
2470 static int net_ads_kerberos_renew(struct net_context *c, int argc, const char **argv)
2471 {
2472         int ret = -1;
2473
2474         if (c->display_usage) {
2475                 d_printf(  "%s\n"
2476                            "net ads kerberos renew\n"
2477                            "    %s\n",
2478                          _("Usage:"),
2479                          _("Renew TGT from existing credential cache"));
2480                 return 0;
2481         }
2482
2483         ret = smb_krb5_renew_ticket(NULL, NULL, NULL, NULL);
2484         if (ret) {
2485                 d_printf(_("failed to renew kerberos ticket: %s\n"),
2486                         error_message(ret));
2487         }
2488         return ret;
2489 }
2490
2491 static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
2492 {
2493         struct PAC_LOGON_INFO *info = NULL;
2494         TALLOC_CTX *mem_ctx = NULL;
2495         NTSTATUS status;
2496         int ret = -1;
2497         const char *impersonate_princ_s = NULL;
2498
2499         if (c->display_usage) {
2500                 d_printf(  "%s\n"
2501                            "net ads kerberos pac\n"
2502                            "    %s\n",
2503                          _("Usage:"),
2504                          _("Dump the Kerberos PAC"));
2505                 return 0;
2506         }
2507
2508         mem_ctx = talloc_init("net_ads_kerberos_pac");
2509         if (!mem_ctx) {
2510                 goto out;
2511         }
2512
2513         if (argc > 0) {
2514                 impersonate_princ_s = argv[0];
2515         }
2516
2517         c->opt_password = net_prompt_pass(c, c->opt_user_name);
2518
2519         status = kerberos_return_pac(mem_ctx,
2520                                      c->opt_user_name,
2521                                      c->opt_password,
2522                                      0,
2523                                      NULL,
2524                                      NULL,
2525                                      NULL,
2526                                      true,
2527                                      true,
2528                                      2592000, /* one month */
2529                                      impersonate_princ_s,
2530                                      &info);
2531         if (!NT_STATUS_IS_OK(status)) {
2532                 d_printf(_("failed to query kerberos PAC: %s\n"),
2533                         nt_errstr(status));
2534                 goto out;
2535         }
2536
2537         if (info) {
2538                 const char *s;
2539                 s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_LOGON_INFO, info);
2540                 d_printf(_("The Pac: %s\n"), s);
2541         }
2542
2543         ret = 0;
2544  out:
2545         TALLOC_FREE(mem_ctx);
2546         return ret;
2547 }
2548
2549 static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char **argv)
2550 {
2551         TALLOC_CTX *mem_ctx = NULL;
2552         int ret = -1;
2553         NTSTATUS status;
2554
2555         if (c->display_usage) {
2556                 d_printf(  "%s\n"
2557                            "net ads kerberos kinit\n"
2558                            "    %s\n",
2559                          _("Usage:"),
2560                          _("Get Ticket Granting Ticket (TGT) for the user"));
2561                 return 0;
2562         }
2563
2564         mem_ctx = talloc_init("net_ads_kerberos_kinit");
2565         if (!mem_ctx) {
2566                 goto out;
2567         }
2568
2569         c->opt_password = net_prompt_pass(c, c->opt_user_name);
2570
2571         ret = kerberos_kinit_password_ext(c->opt_user_name,
2572                                           c->opt_password,
2573                                           0,
2574                                           NULL,
2575                                           NULL,
2576                                           NULL,
2577                                           true,
2578                                           true,
2579                                           2592000, /* one month */
2580                                           &status);
2581         if (ret) {
2582                 d_printf(_("failed to kinit password: %s\n"),
2583                         nt_errstr(status));
2584         }
2585  out:
2586         return ret;
2587 }
2588
2589 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2590 {
2591         struct functable func[] = {
2592                 {
2593                         "kinit",
2594                         net_ads_kerberos_kinit,
2595                         NET_TRANSPORT_ADS,
2596                         N_("Retrieve Ticket Granting Ticket (TGT)"),
2597                         N_("net ads kerberos kinit\n"
2598                            "    Receive Ticket Granting Ticket (TGT)")
2599                 },
2600                 {
2601                         "renew",
2602                         net_ads_kerberos_renew,
2603                         NET_TRANSPORT_ADS,
2604                         N_("Renew Ticket Granting Ticket from credential cache"),
2605                         N_("net ads kerberos renew\n"
2606                            "    Renew Ticket Granting Ticket (TGT) from "
2607                            "credential cache")
2608                 },
2609                 {
2610                         "pac",
2611                         net_ads_kerberos_pac,
2612                         NET_TRANSPORT_ADS,
2613                         N_("Dump Kerberos PAC"),
2614                         N_("net ads kerberos pac\n"
2615                            "    Dump Kerberos PAC")
2616                 },
2617                 {NULL, NULL, 0, NULL, NULL}
2618         };
2619
2620         return net_run_function(c, argc, argv, "net ads kerberos", func);
2621 }
2622
2623 int net_ads(struct net_context *c, int argc, const char **argv)
2624 {
2625         struct functable func[] = {
2626                 {
2627                         "info",
2628                         net_ads_info,
2629                         NET_TRANSPORT_ADS,
2630                         N_("Display details on remote ADS server"),
2631                         N_("net ads info\n"
2632                            "    Display details on remote ADS server")
2633                 },
2634                 {
2635                         "join",
2636                         net_ads_join,
2637                         NET_TRANSPORT_ADS,
2638                         N_("Join the local machine to ADS realm"),
2639                         N_("net ads join\n"
2640                            "    Join the local machine to ADS realm")
2641                 },
2642                 {
2643                         "testjoin",
2644                         net_ads_testjoin,
2645                         NET_TRANSPORT_ADS,
2646                         N_("Validate machine account"),
2647                         N_("net ads testjoin\n"
2648                            "    Validate machine account")
2649                 },
2650                 {
2651                         "leave",
2652                         net_ads_leave,
2653                         NET_TRANSPORT_ADS,
2654                         N_("Remove the local machine from ADS"),
2655                         N_("net ads leave\n"
2656                            "    Remove the local machine from ADS")
2657                 },
2658                 {
2659                         "status",
2660                         net_ads_status,
2661                         NET_TRANSPORT_ADS,
2662                         N_("Display machine account details"),
2663                         N_("net ads status\n"
2664                            "    Display machine account details")
2665                 },
2666                 {
2667                         "user",
2668                         net_ads_user,
2669                         NET_TRANSPORT_ADS,
2670                         N_("List/modify users"),
2671                         N_("net ads user\n"
2672                            "    List/modify users")
2673                 },
2674                 {
2675                         "group",
2676                         net_ads_group,
2677                         NET_TRANSPORT_ADS,
2678                         N_("List/modify groups"),
2679                         N_("net ads group\n"
2680                            "    List/modify groups")
2681                 },
2682                 {
2683                         "dns",
2684                         net_ads_dns,
2685                         NET_TRANSPORT_ADS,
2686                         N_("Issue dynamic DNS update"),
2687                         N_("net ads dns\n"
2688                            "    Issue dynamic DNS update")
2689                 },
2690                 {
2691                         "password",
2692                         net_ads_password,
2693                         NET_TRANSPORT_ADS,
2694                         N_("Change user passwords"),
2695                         N_("net ads password\n"
2696                            "    Change user passwords")
2697                 },
2698                 {
2699                         "changetrustpw",
2700                         net_ads_changetrustpw,
2701                         NET_TRANSPORT_ADS,
2702                         N_("Change trust account password"),
2703                         N_("net ads changetrustpw\n"
2704                            "    Change trust account password")
2705                 },
2706                 {
2707                         "printer",
2708                         net_ads_printer,
2709                         NET_TRANSPORT_ADS,
2710                         N_("List/modify printer entries"),
2711                         N_("net ads printer\n"
2712                            "    List/modify printer entries")
2713                 },
2714                 {
2715                         "search",
2716                         net_ads_search,
2717                         NET_TRANSPORT_ADS,
2718                         N_("Issue LDAP search using filter"),
2719                         N_("net ads search\n"
2720                            "    Issue LDAP search using filter")
2721                 },
2722                 {
2723                         "dn",
2724                         net_ads_dn,
2725                         NET_TRANSPORT_ADS,
2726                         N_("Issue LDAP search by DN"),
2727                         N_("net ads dn\n"
2728                            "    Issue LDAP search by DN")
2729                 },
2730                 {
2731                         "sid",
2732                         net_ads_sid,
2733                         NET_TRANSPORT_ADS,
2734                         N_("Issue LDAP search by SID"),
2735                         N_("net ads sid\n"
2736                            "    Issue LDAP search by SID")
2737                 },
2738                 {
2739                         "workgroup",
2740                         net_ads_workgroup,
2741                         NET_TRANSPORT_ADS,
2742                         N_("Display workgroup name"),
2743                         N_("net ads workgroup\n"
2744                            "    Display the workgroup name")
2745                 },
2746                 {
2747                         "lookup",
2748                         net_ads_lookup,
2749                         NET_TRANSPORT_ADS,
2750                         N_("Perfom CLDAP query on DC"),
2751                         N_("net ads lookup\n"
2752                            "    Find the ADS DC using CLDAP lookups")
2753                 },
2754                 {
2755                         "keytab",
2756                         net_ads_keytab,
2757                         NET_TRANSPORT_ADS,
2758                         N_("Manage local keytab file"),
2759                         N_("net ads keytab\n"
2760                            "    Manage local keytab file")
2761                 },
2762                 {
2763                         "gpo",
2764                         net_ads_gpo,
2765                         NET_TRANSPORT_ADS,
2766                         N_("Manage group policy objects"),
2767                         N_("net ads gpo\n"
2768                            "    Manage group policy objects")
2769                 },
2770                 {
2771                         "kerberos",
2772                         net_ads_kerberos,
2773                         NET_TRANSPORT_ADS,
2774                         N_("Manage kerberos keytab"),
2775                         N_("net ads kerberos\n"
2776                            "    Manage kerberos keytab")
2777                 },
2778                 {NULL, NULL, 0, NULL, NULL}
2779         };
2780
2781         return net_run_function(c, argc, argv, "net ads", func);
2782 }
2783
2784 #else
2785
2786 static int net_ads_noads(void)
2787 {
2788         d_fprintf(stderr, _("ADS support not compiled in\n"));
2789         return -1;
2790 }
2791
2792 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2793 {
2794         return net_ads_noads();
2795 }
2796
2797 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2798 {
2799         return net_ads_noads();
2800 }
2801
2802 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2803 {
2804         return net_ads_noads();
2805 }
2806
2807 int net_ads_join(struct net_context *c, int argc, const char **argv)
2808 {
2809         return net_ads_noads();
2810 }
2811
2812 int net_ads_user(struct net_context *c, int argc, const char **argv)
2813 {
2814         return net_ads_noads();
2815 }
2816
2817 int net_ads_group(struct net_context *c, int argc, const char **argv)
2818 {
2819         return net_ads_noads();
2820 }
2821
2822 int net_ads_gpo(struct net_context *c, int argc, const char **argv)
2823 {
2824         return net_ads_noads();
2825 }
2826
2827 /* this one shouldn't display a message */
2828 int net_ads_check(struct net_context *c)
2829 {
2830         return -1;
2831 }
2832
2833 int net_ads_check_our_domain(struct net_context *c)
2834 {
2835         return -1;
2836 }
2837
2838 int net_ads(struct net_context *c, int argc, const char **argv)
2839 {
2840         return net_ads_noads();
2841 }
2842
2843 #endif  /* WITH_ADS */